diff --git a/pkg/service/submissions.go b/pkg/service/submissions.go
index 35b905f..0426200 100644
--- a/pkg/service/submissions.go
+++ b/pkg/service/submissions.go
@@ -2,12 +2,20 @@ package service
 
 import (
 	"time"
+	"errors"
 	"context"
 	"git.itzana.me/strafesnet/maps-service/pkg/api"
 	"git.itzana.me/strafesnet/maps-service/pkg/model"
 	"git.itzana.me/strafesnet/maps-service/pkg/datastore"
 )
 
+var (
+	// ErrInvalidSourceStatus current submission status cannot change to destination status
+	ErrInvalidSourceStatus = errors.New("Invalid source status")
+	// ErrPermissionDenied caller does not have the required role
+	ErrPermissionDenied = errors.New("Permission denied")
+)
+
 // POST /submissions
 func (svc *Service) CreateSubmission(ctx context.Context, request api.OptSubmissionCreate) (*api.ID, error) {
 	//I don't know how to read the http body
@@ -136,7 +144,22 @@ func (svc *Service) PatchSubmissionModel(ctx context.Context, params api.PatchSu
 //
 // PATCH /submissions/{SubmissionID}/status/publish
 func (svc *Service) ActionSubmissionPublish(ctx context.Context, params api.ActionSubmissionPublishParams) error {
-	return nil
+	submission, err := svc.DB.Submissions().Get(ctx, params.SubmissionID)
+	if err != nil{
+		return err
+	}
+	// check if caller has required role
+	// if !CALLER_ROLES.INCLUDES(ROLE_VALIDATOR){
+	// 	return ErrPermissionDenied
+	// }
+	// check source status
+	if submission.StatusID != model.StatusPublishing{
+		return ErrInvalidSourceStatus
+	}
+	// set status
+	smap := datastore.Optional()
+	smap.Add("status_id",model.StatusPublished)
+	return svc.DB.Submissions().Update(ctx, params.SubmissionID, smap)
 }
 // ActionSubmissionReject invokes actionSubmissionReject operation.
 //
@@ -144,7 +167,22 @@ func (svc *Service) ActionSubmissionPublish(ctx context.Context, params api.Acti
 //
 // PATCH /submissions/{SubmissionID}/status/reject
 func (svc *Service) ActionSubmissionReject(ctx context.Context, params api.ActionSubmissionRejectParams) error {
-	return nil
+	submission, err := svc.DB.Submissions().Get(ctx, params.SubmissionID)
+	if err != nil{
+		return err
+	}
+	// check if caller has required role
+	// if !CALLER_ROLES.INCLUDES(ROLE_Reviewer){
+	// 	return ErrPermissionDenied
+	// }
+	// check source status
+	if submission.StatusID != model.StatusSubmitted{
+		return ErrInvalidSourceStatus
+	}
+	// set status
+	smap := datastore.Optional()
+	smap.Add("status_id",model.StatusRejected)
+	return svc.DB.Submissions().Update(ctx, params.SubmissionID, smap)
 }
 // ActionSubmissionRequestChanges invokes actionSubmissionRequestChanges operation.
 //
@@ -152,7 +190,22 @@ func (svc *Service) ActionSubmissionReject(ctx context.Context, params api.Actio
 //
 // PATCH /submissions/{SubmissionID}/status/request-changes
 func (svc *Service) ActionSubmissionRequestChanges(ctx context.Context, params api.ActionSubmissionRequestChangesParams) error {
-	return nil
+	submission, err := svc.DB.Submissions().Get(ctx, params.SubmissionID)
+	if err != nil{
+		return err
+	}
+	// check if caller has required role
+	// if !CALLER_ROLES.INCLUDES(ROLE_Reviewer){
+	// 	return ErrPermissionDenied
+	// }
+	// check source status
+	if !(submission.StatusID == model.StatusValidated||submission.StatusID == model.StatusAccepted||submission.StatusID == model.StatusSubmitted){
+		return ErrInvalidSourceStatus
+	}
+	// set status
+	smap := datastore.Optional()
+	smap.Add("status_id",model.StatusChangesRequested)
+	return svc.DB.Submissions().Update(ctx, params.SubmissionID, smap)
 }
 // ActionSubmissionRevoke invokes actionSubmissionRevoke operation.
 //
@@ -160,7 +213,22 @@ func (svc *Service) ActionSubmissionRequestChanges(ctx context.Context, params a
 //
 // PATCH /submissions/{SubmissionID}/status/revoke
 func (svc *Service) ActionSubmissionRevoke(ctx context.Context, params api.ActionSubmissionRevokeParams) error {
-	return nil
+	submission, err := svc.DB.Submissions().Get(ctx, params.SubmissionID)
+	if err != nil{
+		return err
+	}
+	// check if caller has required role
+	// if !CALLER_ROLES.INCLUDES(ROLE_Submitter){
+	// 	return ErrPermissionDenied
+	// }
+	// check source status
+	if !(submission.StatusID == model.StatusSubmitted||submission.StatusID == model.StatusChangesRequested){
+		return ErrInvalidSourceStatus
+	}
+	// set status
+	smap := datastore.Optional()
+	smap.Add("status_id",model.StatusUnderConstruction)
+	return svc.DB.Submissions().Update(ctx, params.SubmissionID, smap)
 }
 // ActionSubmissionSubmit invokes actionSubmissionSubmit operation.
 //
@@ -168,7 +236,22 @@ func (svc *Service) ActionSubmissionRevoke(ctx context.Context, params api.Actio
 //
 // PATCH /submissions/{SubmissionID}/status/submit
 func (svc *Service) ActionSubmissionSubmit(ctx context.Context, params api.ActionSubmissionSubmitParams) error {
-	return nil
+	submission, err := svc.DB.Submissions().Get(ctx, params.SubmissionID)
+	if err != nil{
+		return err
+	}
+	// check if caller has required role
+	// if !CALLER_ROLES.INCLUDES(ROLE_Submitter){
+	// 	return ErrPermissionDenied
+	// }
+	// check source status
+	if !(submission.StatusID == model.StatusUnderConstruction||submission.StatusID == model.StatusChangesRequested){
+		return ErrInvalidSourceStatus
+	}
+	// set status
+	smap := datastore.Optional()
+	smap.Add("status_id",model.StatusSubmitted)
+	return svc.DB.Submissions().Update(ctx, params.SubmissionID, smap)
 }
 // ActionSubmissionTriggerPublish invokes actionSubmissionTriggerPublish operation.
 //
@@ -176,7 +259,22 @@ func (svc *Service) ActionSubmissionSubmit(ctx context.Context, params api.Actio
 //
 // PATCH /submissions/{SubmissionID}/status/trigger-publish
 func (svc *Service) ActionSubmissionTriggerPublish(ctx context.Context, params api.ActionSubmissionTriggerPublishParams) error {
-	return nil
+	submission, err := svc.DB.Submissions().Get(ctx, params.SubmissionID)
+	if err != nil{
+		return err
+	}
+	// check if caller has required role
+	// if !CALLER_ROLES.INCLUDES(ROLE_Admin){
+	// 	return ErrPermissionDenied
+	// }
+	// check source status
+	if !(submission.StatusID == model.StatusValidated){
+		return ErrInvalidSourceStatus
+	}
+	// set status
+	smap := datastore.Optional()
+	smap.Add("status_id",model.StatusPublishing)
+	return svc.DB.Submissions().Update(ctx, params.SubmissionID, smap)
 }
 // ActionSubmissionTriggerValidate invokes actionSubmissionTriggerValidate operation.
 //
@@ -184,7 +282,22 @@ func (svc *Service) ActionSubmissionTriggerPublish(ctx context.Context, params a
 //
 // PATCH /submissions/{SubmissionID}/status/trigger-validate
 func (svc *Service) ActionSubmissionTriggerValidate(ctx context.Context, params api.ActionSubmissionTriggerValidateParams) error {
-	return nil
+	submission, err := svc.DB.Submissions().Get(ctx, params.SubmissionID)
+	if err != nil{
+		return err
+	}
+	// check if caller has required role
+	// if !CALLER_ROLES.INCLUDES(ROLE_Reviewer){
+	// 	return ErrPermissionDenied
+	// }
+	// check source status
+	if !(submission.StatusID == model.StatusSubmitted||submission.StatusID == model.StatusAccepted){
+		return ErrInvalidSourceStatus
+	}
+	// set status
+	smap := datastore.Optional()
+	smap.Add("status_id",model.StatusValidating)
+	return svc.DB.Submissions().Update(ctx, params.SubmissionID, smap)
 }
 // ActionSubmissionValidate invokes actionSubmissionValidate operation.
 //
@@ -192,5 +305,20 @@ func (svc *Service) ActionSubmissionTriggerValidate(ctx context.Context, params
 //
 // PATCH /submissions/{SubmissionID}/status/validate
 func (svc *Service) ActionSubmissionValidate(ctx context.Context, params api.ActionSubmissionValidateParams) error {
-	return nil
+	submission, err := svc.DB.Submissions().Get(ctx, params.SubmissionID)
+	if err != nil{
+		return err
+	}
+	// check if caller has required role
+	// if !CALLER_ROLES.INCLUDES(ROLE_VALIDATOR){
+	// 	return ErrPermissionDenied
+	// }
+	// check source status
+	if submission.StatusID != model.StatusValidating{
+		return ErrInvalidSourceStatus
+	}
+	// set status
+	smap := datastore.Optional()
+	smap.Add("status_id",model.StatusValidated)
+	return svc.DB.Submissions().Update(ctx, params.SubmissionID, smap)
 }